ACF values execute stored JavaScript in administrator list tables
Admin Columns for ACF Fields through 0.3.2 outputs Advanced Custom Fields values in WordPress administration list-table columns without escaping them. A Contributor-or-higher user can store a script payload in an affected ACF value, and the JavaScript executes in a higher-privileged user's browser when that user views the corresponding post-list screen. The record does not disclose the affected field types, save path, column renderer or required payload encoding.
- Component
- Admin Columns for ACF Fields
- Plugin slug
admin-columns-for-acf-fields- Affected
- <= 0.3.2
- Safe version
- See mitigation notes
- Published
- Aug 01, 2026
- Weakness
- Not assigned
This CVE was published Aug 01, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
No fixed public release is identified for Admin Columns for ACF Fields through 0.3.2. Restrict ACF editing by untrusted users or deactivate the affected column integration when warranted until a corrected release is available. Review ACF values authored by Contributors for script content and invalidate administrator sessions if an affected list table was viewed.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of higher-privileged users who view the affected post-list screen.